Most companies think about a security incident the way they think about a fire drill they've never actually run: they assume someone will know what to do when it happens. In practice, the first hour ...